When calculating indirect membership of a group all members are
examined and if those have members, those are added as well. This
does not need to be done when the member in question is a user or a
host as they cannot have members.

Advertising

For large groups this is a significant performance improvement (as
well as reducing unnecessary load on 389-ds).

Works for me. However, shouldn't we expand this to all terminal
objects rather than users and hosts?
Something like attached patch? The containers list should be sorted by
probability of encountering the container in real life, with users and
hosts to be at the beginning.

Pushed to master and ipa-2-1.

389-ds is still leaking something but this mitigates it somewhat and
generally reduces the load when showing large groups.